Online Crime Bytes

No Honor Among Thugs: Time to Stop Paying Ransomware Gangs

by Deb Radcliff  

In addition to crippling businesses by making their data inaccessible, ransomware gangs are now routinely copying sensitive data for additional leverage to blackmail victims into paying. When victims don’t pay the blackmail, the criminals leak the sensitive documents on ransomware shaming sites. A recent example: The Scottish Environmental Protection Agency who refused to pay a ransom to the Conti ransomware gang, which then posted 4,000 files (1.2 GB) from the agency.

(Above Screen Capture of Stolen Files Provided by Kurtis Minder)

Even when victims do pay the ransom, the stolen data often shows up on dark web ransomware trading and buying sites, says ransomware investigator and payment negotiator Kurtis Minder. In those cases, new criminals try blackmailing victims again, sometimes months after victims made their payments.

What this means is that ransomware has now become a regulatory issue because sensitive data has been stolen. This trend also begs the question: If paying the ransom doesn’t protect the data and stop further blackmail, why should victims pay ransom anymore?

Now a Regulatory Problem

Imagine, for example, a ransomware attack where the victim company cannot access its own systems and a clock is ticking on sensitive data being leaked to a shaming site. All the while, they are also under regulatory pressure to assess impacted data and report the breaches to the proper authorities.

“The victim business is trying to get back on its feet and now it’s dealing with potential regulatory and legal issues,” says privacy and cyberinsurance attorney, Judy Selby. “Responders to these types of ‘double whammy’ attacks need to know what information was exposed, along with the regulatory, legal and business partner obligations related to that exposure. Meeting these requirements is significantly more complicated in a ransomware situation.”

For example, in the Scottish EPA case uncovered on December 25, 2020, agency officials are still trying to uncover what data was stolen and the sensitivity of that data. All they knew at the time of reporting is that 4,000 files were removed.

Minder, founder and CEO of GroupSense, says every ransomware case he takes on these days involves some form of sensitive data theft, which criminals use to negotiate payouts. According to a recent report by Coveware, more than half of ransomware samples it collected in early 2020 involved sensitive data theft. Top ransomware groups including Sodinokibi, Maze, Netwalker, Mespinoza, and Conti routinely use data theft in their schemes. (For a larger list go here.)

Criminals Lie

Even when ransomware criminals show proof that they deleted the data once the ransomware is paid, Minder and his team still find data files dumped on the darkweb belonging to victims who’ve paid. Many times, he adds, ransomware gangs will return with new threats of exposing the data and re-encrypting their systems.

“Now, I bookend each ransomware negotiation project with, ‘If we decide to do a transaction and pay a ransom, just remember, we’re dealing with someone who has no honor or accountability,'” he adds.

So, since the blackmail won’t stop, then why pay the ransom? If victims and insurers refuse to pay ramsons like the Scottish EPA did, the fat profits (which amounted $20billion in 2020) will simply dry up and the criminals will move to other fertile grounds where making money is easier.

 

 

 

LabMD Charges Government Agencies with Coverup in Cyber Case

By Deb Radcliff

Michael Daugherty has been a fly in the Federal Trade Commission’s ointment ever since his cancer diagnostics company, LabMD, fell into the FTC’s crosshairs in 2008. The case was based on false evidence, he claimed, but his opportunity for recourse was held up until June 2019, when discovery information, including formal depositions related to the case, were filed in the Southern District of New York.

Now, Daugherty has in his possession the depositions and other evidence he needs to take on the FTC, FBI, DOJ, and DHS. On September 4, 2020, Daugherty filed damage claims against all of these agencies on behalf of LabMD and himself, in what he says is the first step of formally filing suit against them.

In their totality, his claims charge that the FBI and DOJ gave a powerful hacking tool to Tiversa (an unreliable source that wasn’t vetted) and covered it up, while the FTC falsified evidence. He claims also that the DHS failed to verify facts and evidence related to the case, and worked with a researcher at Dartmouth College to conceal evidence of wrongdoing.

“I know people didn’t believe me, but this stuff is happening,” says Daugherty. “I myself didn’t truly believe it until I saw the evidence gathered in discovery.”

Daugherty’s claims against these agencies is the culmination of a long and sordid story that goes back to 2007, and is best described in a lengthy and well-researched article in New Yorker Magazine.

Sharing Tools

What’s missing in the New Yorker story is that the FBI gave a powerful spying tool to questionable and sketchy people working at Tiversa, where the founders had no security or technology background, and which itself is now under investigation.

The FBI’s tool, called EP2P, was a modified Peer to Peer networking tool that permitted agents to download a file from a single source, learn the general location of the source, and facilitate the identification of child pornography through hash comparisons and other techniques.

In the discovery files that were produced in 2019, Bob Boback, the Tiversa CEO at the time, said in recorded testimony that FBI agent, Gregg Frankhouser in Pennsylvania, gave EP2P to Tiversa’s CTO on a USB stick in 2007 to use in child porn investigations. Evidence also shows that Tiversa employees used EP2P to reach into the LabMD computer and take sensitive patient data out of the company. This is the sensitive data used in the FTC case that ultimately put LabMD out of business.

Untrustworthy

Daugherty’s claims say that Tiversa was not vetted to be a trustworthy agent of the tool. Tiversa was ultimately raided by the FBI in 2016 after Rick Wallace, Tiversa’s director of special operations, testified that he was ordered by Tiversa’s CEO to falsify records on how the data was collected, changed and stored.

In the testimony recorded in 2019, Tiversa executives hedged and dodged questions but ultimately, their answers reveal that:

• Records were taken off of hundreds of private servers using the FBI hacking tool and keywords specific to the tool.
• Mary Beth Buchanan, attorney for the Western District of Pennsylvania at the time, paid Tiversa’s Richard Wallace to use the FBI’s EP2P tool in search of kiddie porn.
• The agents provided no direction, follow-up or supervision on how the tool was being used by Tiversa.
• Some of Tiversa’s cover up efforts were directed by the FTC, such as setting up a shell company, The Privacy Institute, to park the illegally-obtained data without identifying Tiversa as the source.

Cover Up

By the time Richard Wallace blew the whistle on Tiversa’s malpractice in 2015, Mary Beth Buchanan, U.S. attorney for Western District of PA, had left the government and gone to work for private practice. As a private attorney working for a respected law firm, she talked LabMD’s Daugherty into letting her provide legal counsel in a re-direct examination of the whistleblower, Richard Wallace.

Daugherty says he and his lawyers believed her when she told them that she’d open the kimono and allow Wallace to reveal all evidence during his protected testimony. However, in her redirect, it is plain to read that she omitted questions about the EP2P tools issued by the FBI; and she neglected to bring up Tiversa’s shell company, The Privacy Institute, thus protecting the FTC.

Instead, Wallace was directed to say they were “using a standard, off-the-shelf peer-to-peer client, such as LimeWire or BearShare or Kazaa or Morpheus ...”

“This was a clear case of gaslighting. We trusted that Mary Beth Buchanan would do the right thing, and yet we see that she physically went to the Federal Trade Commission, made a deal, and hushed things up,” Daugherty says.

Impact 

In June 2018, Daugherty won his first case against the FTC, which was also a win for businesses. In that case, the judge ruled that the FTC or other government agency cannot dictate private sector security. As a result, however, the FTC this month announced it has recently tightened up its breach and security requirements so that it can dictate security followup in the case of a breach—something Daugherty says organizations should be wary of.

“This is bad news for CSO’s, especially when you consider the criminal case the FTC and FBI are mounting against Joe Sullivan, Uber CSO,” he warns. “You don’t want government agencies dictating the security of your systems when they don’t even know how to secure their own.”

He also cautions that CSO’s should not roll over to aggressive federal actions, especially if the actions are based in faulty evidence. Complacency in cases like these, he says, sets an example to any abusers in these agencies that they can get away with this type of activity against other businesses.

For now, the agencies have six months to respond to Daugherty’s complaints before he files formal suits against them. Meanwhile, Tiversa has disbanded but its employees and founder are still under investigation. And Tiversa executives will still have to answer to Daugherty, who plans to file civil suits against them in the 11^th Circuit, which has jurisdiction where LabMD was based.

Innovate or Suffocate: Securing New Business Models in a Post Pandemic World

COVID-19 first crept into my scene back in February when I decided not to attend RSA for the first time in 20 years in order to avoid catching a horrific-sounding new virus emerging out of China. Even back then, it felt like this virus was going to dig in and that life would not go back to normal anytime soon—if at all.

Now, seven months later, the virus is still dominating the way people live, socialize, dine, worship, shop, work, learn, play, litigate, marry, entertain, tend to their health, do business, and interact with their governments. (That’s the short list.) And almost all of these changes involve technology.

What does this mean to us as cybersecurity professionals?

1. First, it means many security pros are getting laid off as businesses are negatively-affected by the economic downturn. Why? Because business models that worked in 2019 no longer work in today’s ‘new normal.’
2. So, if we haven’t already, we need to ask ourselves why our businesses are failing during this change and what we can do about it.
3. Then, we must get ahead of the curve through security innovation (and that means a lot more than just securing remote workers).

Turning to Tech

Consider that almost all these COVID-related changes are driving people, even our grandparents, to use new applications and platforms that they never used before, primarily to mimic some form of social gathering that can’t yet be replaced with the virtual experience.

The obvious example is video conferencing, which is now being used for instructing students, conversing with family and friends, talking to our doctors, holding remote meetings and conferences, and providing entertainment (such as SNL and American Idol did recently).

We are also ordering more groceries and takeout online, which is prompting innovation and growth in the area food delivery service, an area that is still lacking but trying to catch up. And more people also filing taxes and their unemployment claims, voting by mail, and using other government services online.

World in Turmoil

Innovation is messy, according to Dave Cole, CEO of cloud-native discovery company, Open Raven, during a recent podcast with Ashwin Krishnan. In it, he explained how he tried holding company meetings in virtual reality, for example, which he said didn’t turn out so well because communication was difficult in the VR room. However, the opportunity is there, and maybe someday the tech will improve to meet the demand.

Innovation is also messy because the world we are innovating in seems to have gone crazy, creating risk scenarios we hadn’t planned for. For example, Zoom, the top video conference platform in use, comes from China—which is known for stealing IP to advance its economic advantage. China is also on the FBI’s list of the top three countries trying to influence the November elections.

These same adversaries are stoking political tensions, Black Lives Matter riots and deadly COVID nonsense over social media platforms that people around the world are turning to for information around on these issues. There are also criminal adversaries bent on inhibiting rsponse to the COVID crisis by getting ransomware into health care providers and ventilator manufacturers.

Butts in Gear

In a call to action, the World Economic Forum in May advised security professionals, particularly leaders, to think more strategically and take leadership during the crisis. Yet, it is easy to get caught up in just fixing the problems as they arise.

To innovate, we need to think five years ahead and anticipate problems arising as the result of political, social and economic trends, according to Ann Cleaveland, the Executive Director at UC Berkeley’s Center for Long-Term Cybersecurity (CLTC) during a webcast with Microsoft CTO Diana Kelley.

For example, she asked, as we move more of our lives online due to social distancing, will people eventually be involved in a social movement to protect themselves online?

Note, too, that the Industry is hurting for security workers even though it is also still laying off, with Cybersecurity Ventures predicting a shortage of 3.5 million cybersecurity professionals in 2021.

In particular, I believe hirers will be looking toward expertise that can understand the new threats that accompany technical innovation in this post-pandemic world, and can innovate security around these trends.

Let’s keep this discussion going and maybe formalize a forum around this topic! Please reach out here or on messenger if you’d like to share and talk.

The Good, the Bad and the Ugly of Social Media During COVID-19

Social media platforms are literally holding us together as a society right now by providing critical venues for remote socialization during this historic (and lengthy) pandemic lockdown.

Unfortunately, criminals are also using these platforms (and our own fears, frustrations and insecurities) against us to defraud us out of money and collect secret information used to protect our accounts. The FBI is reporting hundreds of COVID-19 related scams involving social media, email, and fraudulent domains (web sites) claiming to have cures, vaccines, economic relief packages, loans, community support services, and PPE (personal protective equipment). 

Social Media

For this blog, let’s focus on the risks over social media. Below, are three dominant types social media fraud and misuse that are successful because of the way we’re using and digesting social media during the COVID-19 pandemic:

1. We’re reading more fake ads. Fake ads pretending to have a cure, PPE, vaccine are circulating social media right now. Yet some of these ads are still getting past the Facebook sniff test, according to an April 7 Consumer Reports article. Remember that non-essential workers are staying at home, so even the most popular social media platforms don’t have the manpower they once did to check on fake ads. These ads are aimed at stealing our financial information and even want to scam people out of their COVID-relief checks. These scams are compelling and play on fears, financial hardships, or the desire to help. The FTC advises people to avoid clicking links even from friend postings or private messages without verifying them first.  
2. We’re playing more quizzes. Bored and housebound, more people are sharing quizzes and word games over social media. Those innocuous games asking “If I were a fish (read: phish) what would I be?” are actually designed by criminals to collect answers to common password retrieval security questions used to reset passwords to our personal and financial accounts, according to the FBI. These quiz scams can also get into your address book: Some of these games or quizzes auto fill your private messenger service when you get the answer right, telling you to forward the quiz to all your friends. This happened when I answered a seemingly innocent “how many are in the room” math game. I did not forward that message to any friends, and I didn’t re-post it because it seemed too phishy.
3. Disinformation Bots are Sewing Discord. Bots with hash tags like #ReopenAmericaNow,  #StopTheMadness, #ENDTHESHUTDOWN, are circulating on Twitter and other platforms to sew disinformation and political discord, according to an April 24 Business Insider article. The concern is some of this misinformation can cause physical harm if readers were to congregate together in close quarters, or, say, drink bleach. Postings from such bot accounts are manipulative. They’re designed to elicit strong reactions, either anger or fear primarily, so that under heightened emotions, people may ignore their common sense and act out violently or dangerously. So, it’s important to note our reactions to what we’re reading and ask ourselves why we’re feeling extreme emotions to some of the things we read.

Where to Report

As fun as they seem, avoid filling out the questionnaires and quizzes people post in their social media accounts. And don’t click links you’re unsure of whether they come from a trusted friend or not. Confirm with the source who sent you the links before clicking links they send. If it’s a new posting with a news source linked to it, hover your mouse over the link to see the full URL, and make sure it’s really going to a legitimate news source before you click it. Also don't accept new connections without verifying them first, as well. 

Law enforcement agencies also encourage anyone who’s been scammed or experienced scam attempts like these to file complaints at the Federal Trade Commission and the Internet Crime Complaint Center.

 

Scamming Amazon Users on their Phones

The latest twist in the check-forwarding scam hit someone close to me this month (March 2020). It started when my friend, who is just an average Internet user (and not a security pro like I am) got a call saying her Amazon account has been compromised.

She checked her bank account and saw an unauthorized charge for $100. When she went into her Amazon account, she saw a $100 order for an Xbox gaming gift card. She also got a legitimate email from Amazon stating the same:

$100 Xbox Gift Card [Digital Code]  Mac Download Sold by Amazon.com Services LLC  Review this item $100.00   Item Subtotal: $100.00 Total Before Tax: $100.00 Tax Collected: $0.00 Grand Total: $100.00

Alarmed, my friend continued talking to the caller, who was the very same scammer that had hacked into her Amazon account and made the fraudulent charge.

“They (the scammer) said Amazon was going to pay for me to secure my phone and Amazon account. They had me set up team viewer on my phone and then remotely controlled my phone,” she said.

Promising Money in Return

Here’s where the check forwarding scam comes in. When the scammers went into her bank application and saw only $20, they said Amazon was putting $2,000 into her bank card to reimburse her for paying for her new Amazon account security. They sent her an email confirmation of the pending deposit of $2,000. They said she’d see that clear in a couple of days.

They then directed her to purchase two $500 physical gift cards from Best Buy, staying on the phone with her the whole time.

“After I got the gift cards, they had me scratch off the back and read them the numbers. Then he said my account was only 30% protected from these hackers and I need to get them six more gift cards,” she adds.

That’s when she wised up and called Amazon directly from a different phone and found out it wasn't Amazon doing this. Now, she’s filed a police report and is trying to get her $1,000 back.

Scammers asking for gift cards is a common way for attackers to cash in on their attacks without leaving a trace, according to the Federal Trade Commission.  They will ask for cards to pay your utility bill, buy large merchandise or enter a sweepstakes. But asking my friend to give up gift card numbers scratched off to pay for Amazon security is a new type of scam I can’t find on searches. So, if you see any of these, please report them to the FTC.

No Caller ID

This all happened on her smart phone – the criminals who called her had already hacked into her Amazon account to get her details. Then they called her and accessed her banking app through her phone. The manipulation was harder to see because the email type was small and harder to read the return addresses from her phone.

It would have been difficult to verify where the caller was truly from because she only saw a number. And since she did see the $100 Xbox gift card order in her Amazon account, the call seemed legit.

However, follow-up emails from the scammer tells a different story. Below I’ve highlighted the danger signals in the email itself:

From: Amazon Prime <[email protected]> (this return address does not use the legit Amazon extension “@amazon.com”)

Date: 3/12/20 5:29 PM (GMT-08:00) 

Subject: Amazon Funds For Security 

Dear (NAME BLOCKED OUT)

A refund of $2000.00 has been initiated in your Master Card ending in (# BLOCKED OUT) with Reference code GFTKGH121.

It has been credited in your card with in 24 hours. (basic English language mistake using past instead of future tense “will be”)

If you have any trouble accessing your account, call Customer Service at:

Customers within U.S. and Canada:  1-858-771-8533

Sincerely,

Account Specialist

Amazon.com

https://www.amazon.com

Looking up the scammer’s number on whitepages.com takes you to a Rancho Santa Fe, CA address and also shows that it’s a VOIP (voice over IP number). However, the time stamp lists General Mountain Time so it’s hard to tell where the call is really originating.

Change All Passwords & Close Hacked Account

After learning of this hack, my friend changed all her passwords to her phone, Yahoo, bank and Amazon account and any traces of the remote support tool the attacker used to see her device. Since most of these accounts use email addresses as usernames, I advised her to use unique passwords for every site, and deploy a password manager or the password vault on to manage them all.

Finally, I suggested she report the criminal’s Yahoo email address to Yahoo. But Yahoo doesn’t make it easy to report things like this. The link they provide is pretty useless: https://help.yahoo.com/kb/identify-legitimate-yahoo-websites-requests-communications-sln2070.html. And now, the COVID virus has shut down all Yahoo chat helpers. So, criminals like this are going to continue to take advantage of us without getting caught.

Wish I could help my friend more, but maybe this blog will help others who run into the same or similar scams.

Sharing Photos of Kids

It has always bugged me that people post so many pictures of their kids on Facebook without their kids’ consent. I raised that issue years ago with several parents who regularly posted pictures of their kids on Facebook. 

“Did the kid give permission for that picture to be posted?” I asked them individually over Messenger. “If not, at what age does he or she get rights of consent?”

None of them really answered, I got one vague response about why I was asking, and another response kindly suggesting I get over it: This is the way of things now.

I’ve even gone so far as to suggest removal of some of these photos, for example one of a naked newborn because the creeps out there might get ahold of that image and use it in all the wrong ways. Not to mention the “Oh my God” factor of that person finding out all her nakedness was shown online to a large group of parental friends when just a wee babe.

McAfee nailed this in a recent press release about a survey they conducted on just this topic. In it, the majority of parents didn’t even consider consent, and fathers, mostly, don’t care if the kids get embarrassed by what they post.

On the other hand, the majority did worry about things like kidnapping, pedophilia, and other bad things happening as a result of those pictures being posted online. Yet these same parents also went ahead and posted pictures of their kids in school uniforms or showing other identifying and location related data.

According to the McAfee report, photos are often automatically tagged with location information when uploaded to social media accounts, making it easier to find them. The report also suggests tightening privacy settings if you are inclined to share photos (which is a good rule to follow in general for all postings) and iterating ground rules with family and friends likely to post images of your children.

For more information, see the McAfee release here: https://www.mcafee.com/enterprise/en-us/about/newsroom/press-releases/press-release.html?news_id=20180821005713

"Your Account Has Been Hacked" is a SCAM!

Today, I received an alarming email to myself from myself that came with the subject line: Your Account Was Hacked!

This was a pretty good social engineering attempt and actually got me to open and read the email instead of just deleting it.

The “international group of hackers” who sent the email seemed to have collected an old password that is no longer active on my account. It said they hacked my email because I practiced bad security and went to porn and adult sites; and that they had all kinds of dirt on my web browsing, and the collected video captures from my camera that they’d share with my friends if I don't pay up.

So now the clock is ticking. I have 48 hours from the moment I first read the email to respond or they will send all my boring and mostly spam emails to all my friends and associates.  

Sorry “international hacking group,” but I’m not falling for it and I'm not sending you that $700 you’re demanding.

First of all, I don’t go to porn sites because that’s just stupid.

Secondly, my office where my computer lives is boring. Maybe I don’t have makeup on in some of the pix but that would be the worst worry I’d have about them.

The truth is, anybody can fake your email address and make it look like it’s coming from you. So if you get a note like the one below, DON’T click any link and DON’T reply to them. They are trying to scare and coerce us. Don’t fall for it.

And read the fine print for variations that seem untrue about your online habits.  Here’s the note they sent me verbatim (except I crossed out the old password they had):

Hello!
I'm a member of an international hacker group.

As you could probably have guessed, your account [email protected] was hacked, I sent message you from it.

Now I have access to you accounts! You still do not believe it? So, this is your password: ####, right? 

Within a period from July 5, 2018 to September 21, 2018, you were infected by the virus we've created, through an adult website you've visited.
So far, we have access to your messages, social media accounts, and messengers.
Moreover, we've gotten full damps of these data.

We are aware of your little and big secrets...yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know..

But the key thing is that sometimes we recorded you with your webcam, syncing the recordings with what you watched!
I think you are not interested show this video to your friends, relatives, and your intimate one...

Transfer $700 to our Bitcoin wallet: 1DzM9y4fRgWqpZZCsvf5Rx4HupbE5Q5r4y
I guarantee that after that, we'll erase all your "data" :D

A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount.

Your data will be erased once the money are transferred.
If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection.

You should always think about your security. We hope this case will teach you to keep secrets.
Take care of yourself.

My social media account has never been connected to my email address. I don’t go to porn or adult sites and I don’t have ‘weird’ tastes in those things (that I know of). I don’t use Messenger. And they had the wrong (albeit an old) password.

If I had the time and energy, I’d chase down that bitcoin wallet they want me to transfer the money to! (Maybe one of you brave readers will feel the urge to follow through, please do!)

The puzzle to me now is how they got that old password and from where??? So I’m going to change my passwords across all my accounts now just to be safe.

If you get an email like this that includes an old or even current password, do change your passwords like I am. Also don’t re-use old passwords. And do not share the same passwords with all of your accounts – because once the "international group of hackers" gets one password, they have access to all your accounts using that shared password. 

Back to the Basics: Black Hat 2018

LAS VEGAS, August 7-9 2018 – As nearly 19,000 of us from the hacker and research community descended upon Vegas for Black Hat, the outside temp hit 111 degrees, a record last set in 1994.

Fortunately, the power grid held, and we were kept comfortable (sometimes too cold) for the duration of the two-day security training event at the Mandalay Bay Hotel and Casino. However, some slot machines, elevators, and other embedded systems didn’t fare so well under hacker tinkering over the weekend at Black Hat sister conference, Def Con, as covered by Jack Morse, fellow member of the press.

These hotel hacks reported by Morse were simple demonstrations of software and hardware hacking into critical infrastructure systems (hey, elevators are critical). Demonstrations of grid hacking, car hacking and voting machine hacking were also urgently covered during sessions at both Black Hat and Def Con.

Everything Cyber is Hackable   

Risks from IoT, cloud-based computing, mobility, and lack of resources were topics well-covered by Parisa Tabriz, Google’s Director of Engineering and Project Zero Manager, during her conference kick off keynote, “Optimistic Dissatisfaction with the Status Quo: Steps we Must Take to Improve Security in Complex Landscapes.”

In it, she argued convincingly about going back to the basics – secure design, fast and accurate patching of vulnerabilities - and she told her personal story of challenging the status quo.

Improvement Takes Time

Tabriz used examples of long-term infrastructure improvements, like Chrome’s enforcement of encrypted browsing (HTTPS). Internet providers that use HTTP rather than HTTPS are labeled as insecure starting this past July.

Some businesses object to this ‘Migrate or face embarrassment’ move on Google’s part. Google countered by posting comprehensive help documents for businesses to make the migration.

She also described the time (nearly 7 years) and team commitment put into this upgrade that she called a “feat of engineering.” Myriad browser program interdependencies – from plug ins to the O/S – had to be considered (and no, none of them made it easier with a common language).

 “The message that it took years to make this change is incredibly important,” said Adam Shostack (author of Threat Modelling: Designing for Security) during an impromptu hallway interview shortly after the keynote. “Changes that really matter take time.”

Tabriz also used the keynote to showcase another long-term program developed by her team at Google, Project Zero, which, she says so far has identified 1,400 critical vulnerabilities across O/S, software, cloud-based and hardware systems while speeding up vendor patch times to 90 days or less.

In Support of DevOps

While these Google projects were long in the works, they specifically support today’s demand for faster development by providing more secure foundations and libraries for developers and vulnerability managers, Tabriz explained.

Investments, industry collaboration, and buy-in to infrastructure improvements like this, Tabriz said, take us one step closer to getting ahead of criminals rather than “playing whack-a-mole with our attackers.”

UPDATE! LabMD CEO Tells the Story of FTC Bullying Relying on Stolen Data

June 20, 2018 - Today Michael Daugherty told the whole  sordid story about how a private security firm stole data from one of their internal servers and used it to blackmail his company into paying $450-an-hour for said firms' services to remediate the issue. Ongoing lawsuits are in the works but last week, one of the litigations led to the FTC backing down on demanding security controls that they cannot enforce. Link to his webcast here: https://www.sans.org/webcasts/labmd-phony-data-breach-108400.  

See below for original report: 

Atlanta and Washington DC, June 6, 2018 – Today, the 11^th Circuit U.S. Court of Appeals ruled that the Federal Trade Commission does not have the authority, or the capability, to dictate a sophisticated, on-going process of security controls.

This comes as good news to the petitioner, LabMD, Inc., CEO and Founder Michael Daugherty who wrote a book “The Devil Inside the Beltway,” about his experiences with unreasonable FTC demands. The book sells at Amazon right now.

“The court concludes that the Federal Trade Commission does not possess the legal authority to force companies to implement comprehensive data-security programs,” explains Benjamin Wright, senior instructor for the SANS training institute and practicing technology attorney who has also worked as counsel for LabMD.  “The court held that Congress has not provided the Federal Trade Commission the legal tools it needs in order to force companies to implement effective programs.”

(Full disclosure: Benjamin Wright and I work for the same company, SANS Institute, and have in past worked together on content in my capacity of editor-in-chief of the SANS Analyst Program.)

Unfortunately, the appeals judgment comes too late to save the plaintiff company, LabMD. In 2014, Daugherty shuttered his 30-employee, $4-million, Atlanta-based diagnostics testing business. LabMD was, as he says, crushed under all the litigation and vague demands from the FTC.

“It’s a bittersweet day when a 700,000 patient cancer detection center gets destroyed at the hands of innuendo and overreach by a rogue government agency,” Daugherty says. “I am very gratified by what happens when an Article III court finally gets a case. It needs to happen sooner so agencies win on the merits rather than intimidation.”

Background

The FTC relied on an outside security company’s assessment – a company that alleged it pulled files off a Limewire file sharing service that came from a LabMD accounting computer (while Daugherty claims the file was stolen off the accounting computer by the outside security company).  In 2008, the security firm informed LabMD of the alleged problem. LabMD demanded that the security firm fully explain what had happened, but the explanation never came.

Daugherty, in several court documents and his book, claims that the security firm acted more as an extortionist and when he declined employing this firm (for nearly $40,000) to ‘update LabMD security and fix the problem,’ the firm took the file (with 9,000 patient names and data) to the FTC.

Despite the dubious methods and motivations of the security firm, the FTC ordered LabMD to implement and maintain a comprehensive data security program for many years into the future.

But the court today ruled FTC is not legally constituted to enforce such a complex, nuanced regulatory order.

Wright continues, “A comprehensive data security program is a constant process of striving to be secure. The process is inherently imperfect, and different experts can disagree about what should be done to achieve an effective program. If the FTC orders such a program, it would have to enforce it over the years by way of awkward injunctions from a federal district court.”

Or as the 11^th Circuit Court ruling (in case number 16-16270) puts it:

“The practical effect of repeatedly modifying the injunction at show cause hearings is that the district court is put in the position of managing LabMD’s business in accordance with the Commission’s wishes. It would be as if the Commission was LabMD’s chief executive officer and the court was its operating officer. It is self-evident that this micromanaging is beyond the scope of court oversight contemplated by injunction law."

Wright added: “This case does not bring an end to efforts by the Federal Trade Commission to require information security. But it does change the methods available to the FTC. And it will cause the commission to pause and carefully rethink its direction in this field.”

Cybercriminal Industry Worth Billions; Plus Geopoliticized Malware and Other Scary Findings at RSA 2018

SAN FRANCISCO, April 17, 2018 – Back in 1995, I first started researching the lives and friends of Kevin Mitnick as an author’s assistant for what would turn out to be a best-selling book. Although I wondered what I was getting myself into, I wanted to know who these cyber hackers were, why they broke into systems, and more importantly, I wanted to learn from them.

This need to understand your enemy in cyberspace has become abundantly clear again at the RSA Security Conference this year (Some 23 years later if I’ve done the math right). 

During Monday’s pre-show activities, two companies in particular revealed chilling research uncovered during their security and investigative operations and data collection.

Let’s start with the value attributed to cybercrime and crimeware. At an analyst dinner sponsored by Bromium (the book’s publisher), Dr. Michael McGuire, senior lecturer, University of Surrey estimated the market is easily worth $1.5 trillion, based on interviews with convicted cyber criminals.

“That’s the GDP of a mid-sized country,” he says. “And that’s a very conservative estimate.”

Cybercrime-as-a-service platform managers can earn up to $2 million a year, individual high-earners make up to $166,000 a month, and middle-earners make a mere $75,000 a month, according to his calculations.

Makes you wonder if we (the good guys) are working for the wrong side. But then consider the “dark side” of criminal endeavors involving this much money: kidnapping, coercion, jail time, even murder accompany criminal enterprises of this value. The funds are even being used to fund terrorism in an economy that is so strong it could break the financial system if it were to be brought down, Dr. McGuire conjectures.

Lately, specific cyber crime activity has been shifting away from ransomware and damage-based attacks to accessing stolen computing power to mine bitcoins, according to another equally-compelling report unveiled by Comodo’s Threat Research Labs earlier in the evening.   Back door attacks, which are needed to continue to access the hijacked computer for its bitcoin computing power, are also spiking upwards, according to the report.

The report results, delivered by Comodo senior scientist Kenneth Gears, also shows that greed is not the only motivation behind cyber attacks. On a large display screen, Gears pointed out distinct hikes in regional cyber attacks in South America, Mexico, Canada, the Koreas and Iran (among other countries) during times of political turmoil.

Gears adds “Cyberspace reflects human activity, whether it be an election or conflict.”